CVE-2012-2138

The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service infinite loop via a crafted HTTP request...

Cross site request forgery (csrf)

The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service infinite loop via a crafted HTTP request...

CVE-2012-2138

The vulnerability CVE-2012-2138 affects the Apache Sling project, specifically the org.apache.sling.servlets.post bundle before version 2.1.2. The @CopyFrom operation in the Sling POST servlet fails to prevent copying an ancestor node to a descendant, enabling remote attackers to trigger a denial...

CVE-2012-2138

The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service infinite loop via a crafted HTTP request...

CVE-2012-2138

The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service infinite loop via a crafted HTTP request...

PT-2012-3830

Name of the Vulnerable Software and Affected Versions Apache Sling versions prior to 2.1.2 Description The issue allows remote attackers to cause a denial of service infinite loop via a crafted HTTP request. This is due to the @CopyFrom operation in the POST servlet not preventing attempts to cop...

CVE-2012-2138: Undefined Security Weakness

The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service infinite loop via a crafted HTTP request...

Apache Sling 2.1.0 Denial Of Service

CVE-2012-2138 : Apache Sling denial of service vulnerability Severity: Important Vendor: The Apache Software Foundation Versions Affected: org.apache.sling.servlets.post bundle up to 2.1.0 Description: The @CopyFrom operation of the Sling POST servlet allows for copying a parent node to one of it...

Apache Tomcat: Multiple vulnerabilities

Background Apache Tomcat is a Servlet-3.0/JSP-2.2 Container. Description Multiple vulnerabilities have been discovered in Apache Tomcat. Please review the CVE identifiers referenced below for details. Impact The vulnerabilities allow an attacker to cause a Denial of Service, to hijack a session, ...

JNDI: unauthenticated remote write access is permitted by default

The 1 JNDI service, 2 HA-JNDI service, and 3 HAJNDIFactory invoker servlet in JBoss Enterprise Application Platform 4.3.0 CP10 and 5.1.2, Web Platform 5.1.2, SOA Platform 4.2.0.CP05 and 4.3.0.CP05, Portal Platform 4.3 CP07 and 5.2.x before 5.2.2, and BRMS Platform before 5.3.0 do not properly...

Design/Logic Flaw

The Application Snoop Servlet in IBM WebSphere Application Server 7.0 before 7.0.0.23 does not properly restrict access, which allows remote attackers to obtain sensitive client and request information via a direct request...

CVE-2012-2170

CVE-2012-2170 - IBM WebSphere Application Server (7.x) Affects IBM WebSphere Application Server 7.x prior to 7.0.0.23. The vulnerability stems from the Application Snoop Servlet not properly restricting access, enabling remote attackers to obtain sensitive client and request information via a dir...

CVE-2012-2170: Undefined Security Weakness

The Application Snoop Servlet in IBM WebSphere Application Server 7.0 before 7.0.0.23 does not properly restrict access, which allows remote attackers to obtain sensitive client and request information via a direct request...

PT-2012-3853

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server version 7.0 through 7.0.0.22 Description The issue is related to the Application Snoop Servlet, which does not properly restrict access. This allows remote attackers to obtain sensitive client and request...

IBM WebSphere Application 7.0.0.23 Snoop Servlet信息泄露漏洞

Bugtraq ID: 53755 CVE ID：CVE-2012-2170 IBM WebSphere Application Server WAS是由IBM遵照开放标准，例如Java EE, XML 还有Web Services，开发并发行的一种应用服务器。与其兼容的Web服务器包括：Apache HTTP Server，Netscape Enterprise Server，Microsoft Internet Information Services IIS以及IBM HTTP Server。 WAS 6.1、7.0、8.0在启用了默认Application Snoop...

ConsumerConfigurationServlet Open Redirect

The ConsumerConfigurationServlet servlet has an open redirect vulnerability in the doGet method that will allow phishers to lure users away from legitimate JIRA hosted sites. An open redirect vulnerability is caused by an attacker having control over a request parameter that hasn’t been validated...

USN-1429-1: Jetty vulnerability

It was discovered that Jetty computed hash values for form parameters without restricting the ability to trigger hash collisions predictably. This could allow a remote attacker to cause a denial of service by sending many crafted parameters...

CentOS 6 : tomcat6 (CESA-2012:0475)

Updated tomcat6 packages that fix two security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

CentOS 5 : tomcat5 (CESA-2012:0474)

Updated tomcat5 packages that fix two security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

tomcat6 security update

CentOS Errata and Security Advisory CESA-2012:0475 Updated tomcat6 packages that fix two security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base...